Ways around putting a password in code

Question

I have a bit of code that needs to run with elevated privileges (more that I want the rest of my code running at).

I have my code that sets up the Impersonation working, but it requires a username, domain and password. As my code is in C#.net I know that the password can be found by anyone determined enough.

Is there a way to encrypt the password in my code? Or otherwise secure this password and still be able to pass it in?

Here is the code I am calling:

using (new Impersonator("UserNameGoesHere", "DomainNameGoesGere", "Password Goes Here"))
{
     uint output;
     NetUserAdd(AUTHENTICATION_SERVER, 1, ref userinfo, out output);
     return output;
}

I would love an example that shows how to fix this to not show my password in plain text.

I am using Visual Studio 2008, .NET 3.5 SP1, and running on Windows Server 2003.

Answer 1

Vaccano,

I would recommend investigating the data protection API (DPAPI) for what you're attempting to achieve. It is considered part of the solution in many best practice approaches to reversibly storing passwords needed by applications.

A good article discussing the DPAPI (and other techniques + concerns) can be found here:

http://msdn.microsoft.com/en-us/magazine/cc164054.aspx

With C# 2.0, P/Invoking isn't even required; managed wrappers exist:

http://blogs.freshlogicstudios.com/Posts/View.aspx?Id=41ca5a99-ddc0-4d0a-9919-2ce10bf50c7e

I hope this helps!